@@ -52,6 +52,26 @@ function createSynologySetupPrompter(params: { allowedUserIds?: string } = {}) {
5252});
5353}
545455+async function expectDmAuthorization(params: {
56+userId: string;
57+dmPolicy: "open" | "allowlist" | "disabled";
58+allowedUserIds: string[];
59+allowed: boolean;
60+reasonCode?: string;
61+}): Promise<void> {
62+const auth = await authorizeUserForDmWithIngress({
63+accountId: "default",
64+userId: params.userId,
65+dmPolicy: params.dmPolicy,
66+allowedUserIds: params.allowedUserIds,
67+});
68+69+expect(auth.senderAccess.allowed).toBe(params.allowed);
70+if (params.reasonCode !== undefined) {
71+expect(auth.senderAccess.reasonCode).toBe(params.reasonCode);
72+}
73+}
74+5575describe("synology-chat core", () => {
5676afterAll(() => {
5777vi.unstubAllEnvs();
@@ -317,74 +337,46 @@ describe("synology-chat security helpers", () => {
317337});
318338319339it("matches DM policy decisions through channel ingress", async () => {
320-await expect(
321-authorizeUserForDmWithIngress({
322-accountId: "default",
323-userId: "user1",
324-dmPolicy: "open",
325-allowedUserIds: [],
326-}),
327-).resolves.toMatchObject({
328-senderAccess: {
329-allowed: false,
330-reasonCode: "dm_policy_not_allowlisted",
331-},
340+await expectDmAuthorization({
341+userId: "user1",
342+dmPolicy: "open",
343+allowedUserIds: [],
344+allowed: false,
345+reasonCode: "dm_policy_not_allowlisted",
332346});
333-await expect(
334-authorizeUserForDmWithIngress({
335-accountId: "default",
336-userId: "user1",
337-dmPolicy: "open",
338-allowedUserIds: ["*"],
339-}),
340-).resolves.toMatchObject({ senderAccess: { allowed: true } });
341-await expect(
342-authorizeUserForDmWithIngress({
343-accountId: "default",
344-userId: "user1",
345-dmPolicy: "disabled",
346-allowedUserIds: ["user1"],
347-}),
348-).resolves.toMatchObject({
349-senderAccess: {
350-allowed: false,
351-reasonCode: "dm_policy_disabled",
352-},
347+await expectDmAuthorization({
348+userId: "user1",
349+dmPolicy: "open",
350+allowedUserIds: ["*"],
351+allowed: true,
353352});
354-await expect(
355-authorizeUserForDmWithIngress({
356-accountId: "default",
357-userId: "user1",
358-dmPolicy: "allowlist",
359-allowedUserIds: [],
360-}),
361-).resolves.toMatchObject({
362-senderAccess: {
363-allowed: false,
364-reasonCode: "dm_policy_not_allowlisted",
365-},
353+await expectDmAuthorization({
354+userId: "user1",
355+dmPolicy: "disabled",
356+allowedUserIds: ["user1"],
357+allowed: false,
358+reasonCode: "dm_policy_disabled",
366359});
367-await expect(
368-authorizeUserForDmWithIngress({
369-accountId: "default",
370-userId: "user9",
371-dmPolicy: "allowlist",
372-allowedUserIds: ["user1"],
373-}),
374-).resolves.toMatchObject({
375-senderAccess: {
376-allowed: false,
377-reasonCode: "dm_policy_not_allowlisted",
378-},
360+await expectDmAuthorization({
361+userId: "user1",
362+dmPolicy: "allowlist",
363+allowedUserIds: [],
364+allowed: false,
365+reasonCode: "dm_policy_not_allowlisted",
366+});
367+await expectDmAuthorization({
368+userId: "user9",
369+dmPolicy: "allowlist",
370+allowedUserIds: ["user1"],
371+allowed: false,
372+reasonCode: "dm_policy_not_allowlisted",
373+});
374+await expectDmAuthorization({
375+userId: "user1",
376+dmPolicy: "allowlist",
377+allowedUserIds: ["user1", "user2"],
378+allowed: true,
379379});
380-await expect(
381-authorizeUserForDmWithIngress({
382-accountId: "default",
383-userId: "user1",
384-dmPolicy: "allowlist",
385-allowedUserIds: ["user1", "user2"],
386-}),
387-).resolves.toMatchObject({ senderAccess: { allowed: true } });
388380});
389381390382it("redacts Synology user IDs and allowlist entries from ingress state/decision", async () => {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。